1Password

1Password is a widely trusted password manager and secrets vault solution, allowing individuals and teams to securely store, access, and share passwords, API credentials, and sensitive information. With robust encryption, granular access controls, and seamless syncing across devices, 1Password supports teams and organizations in managing secrets efficiently and securely.

The 1Password Connect API allows programmatic access to vaults and items within an organization's 1Password account. This integration in AACFlow.io lets you automate secret retrieval, onboarding workflows, secret rotation, vault audits, and more, all in a secure and auditable manner.

With 1Password in your AACFlow.io workflow, you can:

List, search, and retrieve vaults: Access metadata or browse available vaults for organizing secrets by project or purpose
Fetch items and secrets: Get credentials, API keys, or custom secrets in real time to power your workflows securely
Create, update, or delete secrets: Automate secret management, provisioning, and rotation for enhanced security practices
Integrate with CI/CD and automation: Fetch credentials or tokens only when needed, reducing manual work and reducing risk
Ensure access controls: Leverage role-based access and fine-grained permissions to control which agents or users can access specific secrets

By connecting AACFlow.io with 1Password, you empower your agents to securely manage secrets, reduce manual overhead, and maintain best practices for security automation, incident response, and DevOps workflows—all while ensuring secrets never leave a controlled environment.

Usage Instructions

Access and manage secrets stored in 1Password vaults using the Connect API or Service Account SDK. List vaults, retrieve items with their fields and secrets, download attached files, create new items, update existing ones, delete items, and resolve secret references.

Parameter	Type	Required	Description
`connectionMode`	string	No	Connection mode: "service_account" or "connect"
`serviceAccountToken`	string	No	1Password Service Account token (for Service Account mode)
`apiKey`	string	No	1Password Connect API token (for Connect Server mode)
`serverUrl`	string	No	1Password Connect server URL (for Connect Server mode)
`filter`	string	No	SCIM filter expression (e.g., name eq "My Vault")

Output

Parameter	Type	Description
`vaults`	array	List of accessible vaults
↳ `id`	string	Vault ID
↳ `name`	string	Vault name
↳ `description`	string	Vault description
↳ `attributeVersion`	number	Vault attribute version
↳ `contentVersion`	number	Vault content version
↳ `type`	string	Vault type (USER_CREATED, PERSONAL, or EVERYONE)
↳ `createdAt`	string	Creation timestamp
↳ `updatedAt`	string	Last update timestamp

`onepassword_get_vault`

Get details of a specific vault by ID

Input

Parameter	Type	Required	Description
`connectionMode`	string	No	Connection mode: "service_account" or "connect"
`serviceAccountToken`	string	No	1Password Service Account token (for Service Account mode)
`apiKey`	string	No	1Password Connect API token (for Connect Server mode)
`serverUrl`	string	No	1Password Connect server URL (for Connect Server mode)
`vaultId`	string	Yes	The vault UUID

Output

Parameter	Type	Description
`id`	string	Vault ID
`name`	string	Vault name
`description`	string	Vault description
`attributeVersion`	number	Vault attribute version
`contentVersion`	number	Vault content version
`items`	number	Number of items in the vault
`type`	string	Vault type (USER_CREATED, PERSONAL, or EVERYONE)
`createdAt`	string	Creation timestamp
`updatedAt`	string	Last update timestamp

`onepassword_list_items`

List items in a vault. Returns summaries without field values.

Input

Parameter	Type	Required	Description
`connectionMode`	string	No	Connection mode: "service_account" or "connect"
`serviceAccountToken`	string	No	1Password Service Account token (for Service Account mode)
`apiKey`	string	No	1Password Connect API token (for Connect Server mode)
`serverUrl`	string	No	1Password Connect server URL (for Connect Server mode)
`vaultId`	string	Yes	The vault UUID to list items from
`filter`	string	No	SCIM filter expression (e.g., title eq "API Key" or tag eq "production")

Output

Parameter	Type	Description
`items`	array	List of items in the vault (summaries without field values)
↳ `id`	string	Item ID
↳ `title`	string	Item title
↳ `vault`	object	Vault reference
↳ `id`	string	Vault ID
↳ `category`	string	Item category (e.g., LOGIN, API_CREDENTIAL)
↳ `urls`	array	URLs associated with the item
↳ `href`	string	URL
↳ `label`	string	URL label
↳ `primary`	boolean	Whether this is the primary URL
↳ `favorite`	boolean	Whether the item is favorited
↳ `tags`	array	Item tags
↳ `version`	number	Item version number
↳ `state`	string	Item state (ARCHIVED, or absent/null when active)
↳ `createdAt`	string	Creation timestamp
↳ `updatedAt`	string	Last update timestamp
↳ `lastEditedBy`	string	ID of the last editor

`onepassword_get_item`

Get full details of an item including all fields and secrets

Input

Parameter	Type	Required	Description
`connectionMode`	string	No	Connection mode: "service_account" or "connect"
`serviceAccountToken`	string	No	1Password Service Account token (for Service Account mode)
`apiKey`	string	No	1Password Connect API token (for Connect Server mode)
`serverUrl`	string	No	1Password Connect server URL (for Connect Server mode)
`vaultId`	string	Yes	The vault UUID
`itemId`	string	Yes	The item UUID to retrieve

Output

Parameter	Type	Description
`response`	json	Deprecated — kept for backward compatibility with workflows saved before per-operation outputs were added below. Never populated; use the operation-specific outputs instead.
`vaults`	json	List of accessible vaults [{id, name, description, items, type, createdAt, updatedAt}]
`id`	string	Vault or item ID
`name`	string	Vault name
`description`	string	Vault description
`items`	json	Number of items in the vault (Get Vault) or item summaries [{id, title, category, tags, favorite, version, updatedAt}] (List Items)
`type`	string	Vault type (USER_CREATED, PERSONAL, or EVERYONE)
`title`	string	Item title
`category`	string	Item category (e.g., LOGIN, API_CREDENTIAL, SECURE_NOTE)
`vault`	json	Vault reference the item belongs to {id}
`fields`	json	Item fields including secrets [{id, label, type, purpose, value}]
`sections`	json	Item sections [{id, label}]
`files`	json	Files attached to the item [{id, name, size, section}] — fetch content with Get Item File
`tags`	json	Item tags
`urls`	json	URLs associated with the item [{href, label, primary}]
`favorite`	boolean	Whether the item is favorited
`version`	number	Item version number
`state`	string	Item state (ARCHIVED, or absent/null when active)
`lastEditedBy`	string	ID of the last editor
`createdAt`	string	Creation timestamp
`updatedAt`	string	Last update timestamp
`success`	boolean	Whether the item was successfully deleted
`value`	string	The resolved secret value
`reference`	string	The original secret reference URI
`file`	file	Downloaded file attachment

`onepassword_get_item_file`

Download the content of a file attached to an item

Input

Parameter	Type	Required	Description
`connectionMode`	string	No	Connection mode: "service_account" or "connect"
`serviceAccountToken`	string	No	1Password Service Account token (for Service Account mode)
`apiKey`	string	No	1Password Connect API token (for Connect Server mode)
`serverUrl`	string	No	1Password Connect server URL (for Connect Server mode)
`vaultId`	string	Yes	The vault UUID
`itemId`	string	Yes	The item UUID the file is attached to
`fileId`	string	Yes	The file ID (from the item's "files" array, e.g. via Get Item)

Output

Parameter	Type	Description
`file`	file	Downloaded file attachment

`onepassword_create_item`

Create a new item in a vault

Input

Parameter	Type	Required	Description
`connectionMode`	string	No	Connection mode: "service_account" or "connect"
`serviceAccountToken`	string	No	1Password Service Account token (for Service Account mode)
`apiKey`	string	No	1Password Connect API token (for Connect Server mode)
`serverUrl`	string	No	1Password Connect server URL (for Connect Server mode)
`vaultId`	string	Yes	The vault UUID to create the item in
`category`	string	Yes	Item category (e.g., LOGIN, PASSWORD, API_CREDENTIAL, SECURE_NOTE, SERVER, DATABASE)
`title`	string	No	Item title
`tags`	string	No	Comma-separated list of tags
`fields`	string	No	JSON array of field objects (e.g., [{"label":"username","value":"admin","type":"STRING","purpose":"USERNAME"}]). "purpose" is honored in Connect Server mode; in Service Account mode 1Password infers it from the field label/type instead.

Output

Parameter	Type	Description
`response`	json	Deprecated — kept for backward compatibility with workflows saved before per-operation outputs were added below. Never populated; use the operation-specific outputs instead.
`vaults`	json	List of accessible vaults [{id, name, description, items, type, createdAt, updatedAt}]
`id`	string	Vault or item ID
`name`	string	Vault name
`description`	string	Vault description
`items`	json	Number of items in the vault (Get Vault) or item summaries [{id, title, category, tags, favorite, version, updatedAt}] (List Items)
`type`	string	Vault type (USER_CREATED, PERSONAL, or EVERYONE)
`title`	string	Item title
`category`	string	Item category (e.g., LOGIN, API_CREDENTIAL, SECURE_NOTE)
`vault`	json	Vault reference the item belongs to {id}
`fields`	json	Item fields including secrets [{id, label, type, purpose, value}]
`sections`	json	Item sections [{id, label}]
`files`	json	Files attached to the item [{id, name, size, section}] — fetch content with Get Item File
`tags`	json	Item tags
`urls`	json	URLs associated with the item [{href, label, primary}]
`favorite`	boolean	Whether the item is favorited
`version`	number	Item version number
`state`	string	Item state (ARCHIVED, or absent/null when active)
`lastEditedBy`	string	ID of the last editor
`createdAt`	string	Creation timestamp
`updatedAt`	string	Last update timestamp
`success`	boolean	Whether the item was successfully deleted
`value`	string	The resolved secret value
`reference`	string	The original secret reference URI
`file`	file	Downloaded file attachment

`onepassword_replace_item`

Replace an entire item with new data (full update)

Input

Parameter	Type	Required	Description
`connectionMode`	string	No	Connection mode: "service_account" or "connect"
`serviceAccountToken`	string	No	1Password Service Account token (for Service Account mode)
`apiKey`	string	No	1Password Connect API token (for Connect Server mode)
`serverUrl`	string	No	1Password Connect server URL (for Connect Server mode)
`vaultId`	string	Yes	The vault UUID
`itemId`	string	Yes	The item UUID to replace
`item`	string	Yes	JSON object representing the full item (e.g., {"vault":{"id":"..."},"category":"LOGIN","title":"My Item","fields":[...]})

Output

Parameter	Type	Description
`response`	json	Deprecated — kept for backward compatibility with workflows saved before per-operation outputs were added below. Never populated; use the operation-specific outputs instead.
`vaults`	json	List of accessible vaults [{id, name, description, items, type, createdAt, updatedAt}]
`id`	string	Vault or item ID
`name`	string	Vault name
`description`	string	Vault description
`items`	json	Number of items in the vault (Get Vault) or item summaries [{id, title, category, tags, favorite, version, updatedAt}] (List Items)
`type`	string	Vault type (USER_CREATED, PERSONAL, or EVERYONE)
`title`	string	Item title
`category`	string	Item category (e.g., LOGIN, API_CREDENTIAL, SECURE_NOTE)
`vault`	json	Vault reference the item belongs to {id}
`fields`	json	Item fields including secrets [{id, label, type, purpose, value}]
`sections`	json	Item sections [{id, label}]
`files`	json	Files attached to the item [{id, name, size, section}] — fetch content with Get Item File
`tags`	json	Item tags
`urls`	json	URLs associated with the item [{href, label, primary}]
`favorite`	boolean	Whether the item is favorited
`version`	number	Item version number
`state`	string	Item state (ARCHIVED, or absent/null when active)
`lastEditedBy`	string	ID of the last editor
`createdAt`	string	Creation timestamp
`updatedAt`	string	Last update timestamp
`success`	boolean	Whether the item was successfully deleted
`value`	string	The resolved secret value
`reference`	string	The original secret reference URI
`file`	file	Downloaded file attachment

`onepassword_update_item`

Update an existing item using JSON Patch operations (RFC6902)

Input

Parameter	Type	Required	Description
`connectionMode`	string	No	Connection mode: "service_account" or "connect"
`serviceAccountToken`	string	No	1Password Service Account token (for Service Account mode)
`apiKey`	string	No	1Password Connect API token (for Connect Server mode)
`serverUrl`	string	No	1Password Connect server URL (for Connect Server mode)
`vaultId`	string	Yes	The vault UUID
`itemId`	string	Yes	The item UUID to update
`operations`	string	Yes	JSON array of RFC6902 patch operations (e.g., [{"op":"replace","path":"/title","value":"New Title"}])

Output

Parameter	Type	Description
`response`	json	Deprecated — kept for backward compatibility with workflows saved before per-operation outputs were added below. Never populated; use the operation-specific outputs instead.
`vaults`	json	List of accessible vaults [{id, name, description, items, type, createdAt, updatedAt}]
`id`	string	Vault or item ID
`name`	string	Vault name
`description`	string	Vault description
`items`	json	Number of items in the vault (Get Vault) or item summaries [{id, title, category, tags, favorite, version, updatedAt}] (List Items)
`type`	string	Vault type (USER_CREATED, PERSONAL, or EVERYONE)
`title`	string	Item title
`category`	string	Item category (e.g., LOGIN, API_CREDENTIAL, SECURE_NOTE)
`vault`	json	Vault reference the item belongs to {id}
`fields`	json	Item fields including secrets [{id, label, type, purpose, value}]
`sections`	json	Item sections [{id, label}]
`files`	json	Files attached to the item [{id, name, size, section}] — fetch content with Get Item File
`tags`	json	Item tags
`urls`	json	URLs associated with the item [{href, label, primary}]
`favorite`	boolean	Whether the item is favorited
`version`	number	Item version number
`state`	string	Item state (ARCHIVED, or absent/null when active)
`lastEditedBy`	string	ID of the last editor
`createdAt`	string	Creation timestamp
`updatedAt`	string	Last update timestamp
`success`	boolean	Whether the item was successfully deleted
`value`	string	The resolved secret value
`reference`	string	The original secret reference URI
`file`	file	Downloaded file attachment

`onepassword_delete_item`

Delete an item from a vault

Input

Parameter	Type	Required	Description
`connectionMode`	string	No	Connection mode: "service_account" or "connect"
`serviceAccountToken`	string	No	1Password Service Account token (for Service Account mode)
`apiKey`	string	No	1Password Connect API token (for Connect Server mode)
`serverUrl`	string	No	1Password Connect server URL (for Connect Server mode)
`vaultId`	string	Yes	The vault UUID
`itemId`	string	Yes	The item UUID to delete

Output

Parameter	Type	Description
`success`	boolean	Whether the item was successfully deleted

`onepassword_resolve_secret`

Resolve a secret reference (op://vault/item/field) to its value. Service Account mode only.

Input

Parameter	Type	Required	Description
`connectionMode`	string	No	Connection mode: must be "service_account" for this operation
`serviceAccountToken`	string	Yes	1Password Service Account token
`secretReference`	string	Yes	Secret reference URI (e.g., op://vault-name/item-name/field-name or op://vault-name/item-name/section-name/field-name)

Output

Parameter	Type	Description
`value`	string	The resolved secret value
`reference`	string	The original secret reference URI

1Password

Usage Instructions

Actions

`onepassword_list_vaults`

Input

Output

`onepassword_get_vault`

Input

Output

`onepassword_list_items`

Input

Output

`onepassword_get_item`

Input

Output

`onepassword_get_item_file`

Input

Output

`onepassword_create_item`

Input

Output

`onepassword_replace_item`

Input

Output

`onepassword_update_item`

Input

Output

`onepassword_delete_item`

Input

Output

`onepassword_resolve_secret`

Input

Output

On this page